CVE-2026-86350
Apache Tomcat: HTTP/2 request header mix-up from a regression in the CVE-2026-41293 fix
Technology
Apache Tomcat
CVSS Score
9.1 / 10.0
Affected Versions
11.0.22 to 11.0.25; 10.1.55 to 10.1.59; 9.0.118 to 9.0.121
Upstream Fix
11.0.26; 10.1.60; 9.0.122
Published
September 23, 2026
OSSeva Coverage
Fixed upstream
Description
A regression in the fix for CVE-2026-41293 led Tomcat to interpret HTTP/2 requests inconsistently, which could mix up request headers between requests. Only the releases that carried that fix are affected. Made public on 23 September 2026 and rated Important by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.
Is your Apache Tomcat deployment affected?
If you're running 11.0.22 to 11.0.25; 10.1.55 to 10.1.59; 9.0.118 to 9.0.121, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.22 to 11.0.25; 10.1.55 to 10.1.59; 9.0.118 to 9.0.121?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?